rage.fail

azure-appsvc-msi-token

Any code in the app worker can mint a bearer token for each bound MI via the App Service MSI token endpoint.

derived azure emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'site': None} ExecutesAs {'mi': None}

emit

source	`<Microsoft.Web/sites>`
target	`<managed identity bound to the site>`

Narrative

Any code running in {site.name} can request a bearer token for {mi.name} from the App Service MSI endpoint (no app credential required).

Raw rule rules/derived/azure/appservice.yaml

id: azure-appsvc-msi-token
emits: CanRetrieveToken
description: Any code in the app worker can mint a bearer token for each bound MI via the App Service
  MSI token endpoint.
match:
- - site: null
  - ExecutesAs
  - mi: null
emit:
  source: <Microsoft.Web/sites>
  target: <managed identity bound to the site>
  permissions: []
  note: 'MSI endpoint: GET %IDENTITY_ENDPOINT%?resource=<aud>&api-version=2019-08-01 with header ''X-IDENTITY-HEADER:
    %IDENTITY_HEADER%'' (legacy MSI_ENDPOINT/MSI_SECRET). NOT 169.254 IMDS. The companion credential-exposure
    fact is emitted by azure-appsvc-msi-exposescred (ExposesCredential).'
  false_positive_note: Only fires when the site actually has a managed identity (identity.type != None).
    No MI => no token; do NOT emit.
  narrative: Any code running in {site.name} can request a bearer token for {mi.name} from the App Service
    MSI endpoint (no app credential required).